How to bulk deactivate users in Salesforce (and get past "You cannot deactivate this user")

Deactivating one Salesforce user is three clicks. Deactivating forty after a restructure, or every account that has not logged in since the last licence renewal, is an afternoon of edit, untick, save. Then a pop-up tells you that you cannot deactivate this user and sends you off to find out why.

This guide gives you a safe order for offboarding many users at once: what to do first, what blocks deactivation, the bulk options, and what to clean up afterwards.

Deactivate, don't delete (you can't anyway)

Salesforce does not let you delete users. Every user is linked to records they created, own or approved, and deleting them would orphan that history. Deactivating removes login access and frees the licence, while keeping the user record, their history and every link to it.

Two consequences people often miss:

• Deactivation does not change ownership. A deactivated rep still owns their accounts, opportunities and leads, and still appears in forecasts, until you transfer those records.
• It is reversible. You can reactivate a user, as long as you have a licence free for them.

Step 1: Freeze first

When someone leaves, the priority is cutting access now. Clearing blockers and reassigning records can take longer. Freezing a user stops them logging in straight away without changing anything else, so you can do the rest of the clean-up safely.

• In Setup → Users, open the user and click Freeze.
• In bulk, freezing is the IsFrozen field on the UserLogin object, which Data Loader or any API tool can update.

Freeze on the leaving date. Deactivate once the blockers below are cleared.

Step 2: Clear what blocks deactivation

"You cannot deactivate this user" means the user is named somewhere Salesforce needs an active person. The usual suspects, from Salesforce's own admin guidance:

Also check approval processes. If the person was an approver, take them out of the process or give their approvals to someone else. Otherwise requests stall waiting for someone who can no longer log in.

Bulk tip: fix a blocker once for everyone. If three leavers are all email alert recipients, replace them with a shared mailbox or a public group, so the next leaver does not block you too.

Step 3: Deactivate in bulk

Setup has no multi-select "Deactivate" button for internal users. You have three realistic options.

Option A: Data Loader (or any API tool)

1. Export the users you want, with at least Id and IsActive. A SOQL filter on LastLoginDate works well for dormant accounts:

   SELECT Id, Username, LastLoginDate
   FROM User
   WHERE IsActive = true
     AND UserType = 'Standard'
     AND (LastLoginDate < LAST_N_DAYS:90 OR LastLoginDate = null)
   

2. Set IsActive to false in the CSV.

3. Run an Update on the User object.

4. Read the error file. Any user who hit a blocker from Step 2 fails individually with Salesforce's reason. Clear it and re-run just those rows.

Two cautions. Never include your own user or an integration user in the file. Deactivating the account an integration signs in as breaks it immediately. And check CreatedDate before treating "never logged in" as dormant, because a user created yesterday has not logged in either.

Option B: orgadmin.ai User Management

User Management gives you the user list with the filters that matter for offboarding: never logged in, idle 30+ or 90+ days, by profile, role and status. Tick the users and deactivate them together.

• Up to 400 users in one action, with per-row results. A user blocked by a default-owner setting is reported against that user, with Salesforce's message, and everyone else is deactivated normally.
• It will not lock you out. The Salesforce user your connection signs in as is filtered out on the server and reported as skipped, so a bulk run can never deactivate the account the app depends on.
• Who can do it is controlled. Browsing and the health report need workspace access. Deactivating needs an owner or admin with writes enabled. Every change is audit-logged.

Its user health report is the fastest way to build the list in the first place: dormant accounts, users who have never logged in, frozen and locked users, and the sharpest signal of all, dormant accounts that still hold Modify All Data, View All Data or Manage Users.

Option C: Manually in Setup

Fine for two or three users. Setup → Users → Edit → untick Active → Save. Past a handful, use A or B.

Step 4: Reassign what they owned

Deactivated users keep their records until you move them:

• Records: Setup → Mass Transfer Records handles accounts, leads and custom objects. Opportunities usually move along with their accounts, depending on the options you tick.
• Queues and public groups: remove the user, so work is not routed to someone who will never pick it up.
• Chatter groups and reports: a deactivated user can still own a Chatter group, and reports in their personal folders are easy to forget. Move anything shared.
• Scheduled jobs and running user: scheduled reports, dashboards with the leaver as running user, and any flow or scheduled Apex they own. These fail quietly, which makes them the most expensive to miss.

Step 5: Confirm, and make it routine

• Run an inactive-users list view to confirm the count matches your list.
• Check the licence count in Company Information. Freed licences show up immediately.
• Agree a trigger with HR or IT, so you hear about leavers on the day rather than at the next audit.

Do a dormant-user sweep at least quarterly, and make dormant accounts with elevated permissions the first thing you check. They are a real security risk, not just a licence cost. Our guide on how often to audit Salesforce security puts that sweep into a wider review schedule.

Quick checklist

1. Freeze leavers on their last day.
2. Clear default owner/creator settings, email alert recipients, hierarchy fields and approval steps.
3. Deactivate in bulk, never including your own or an integration user.
4. Re-run the failures after fixing each reported blocker.
5. Transfer records, queues, groups, scheduled reports and running-user settings.
6. Confirm licences are freed, then schedule the next sweep.